CenterPoint Energy confirms data breach following claims on hacking forum
CenterPoint Energy confirmed a breach after a hacker claimed stealing 7.49 million customer records via an unauthenticated API lacking WAF, rate limiting, and token checks.
CenterPoint Energy, a Houston-based utility serving about 7 million customers, confirmed in a September 14 SEC Form 8-K that an unauthorized third party accessed customer data through an external system after a hacker posted a 7.49 million-line dataset online. The exposed fields include names, phone numbers, addresses, account numbers, emails, driver's license numbers, and the last four digits of Social Security numbers. The hacker said the API had no web application firewall, rate limiting, certificate checks, or authentication token, and that a CAPTCHA stopped exfiltration at 7.49 million of a claimed 17.44 million lines. The company faces multiple class action lawsuits and is working with outside experts to determine scope.
- Hacker alias '4d722e4d656f77' claims 7.49M lines pulled in JSONL then CSV
- Unauthenticated API lacked WAF, rate limiting, certificate checks, and tokens
- Exposed data includes driver's license numbers and last four SSN digits
- CenterPoint filed SEC 8-K on September 14; utility services unaffected
- Multiple class action lawsuits filed by customers across several states
- Vendors
- CenterPoint Energy
- Threat actors
- 4d722e4d656f77
- Victims
- CenterPoint Energy
- Organizations
- CenterPoint EnergySEC
- Countries
- United States
From the original article
1 min read at helpnetsecurity.com
CenterPoint Energy disclosed that an unauthorized third party got into customer data through one of its external systems, after online claims by a hacker that millions of records had been stolen from the company. CenterPoint Energy is a Houston-based public utility company that provides electricity and natural gas services. It serves about 7 million customers across Indiana, Minnesota, Ohio, and Texas.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.